Tools & policy

Tools are registered through ToolContributor and executed through ToolExecutor. Providers only see ToolSpec schemas; the runtime owns policy checks, approval events, execution context, and result routing.

Built-in coding tools

• read_file and list_files for scoped filesystem reads.
• grep and glob for workspace discovery. With unrestricted filesystem access, glob also accepts absolute patterns outside the workspace.
• write_file, edit, and multi_edit for edit-oriented models.
• apply_patch for patch-oriented models, including the Responses freeform custom-tool channel for GPT-5.5.
• view_image for validated local or remote-runner image inspection by vision-capable models.
• echo for deterministic tests and simple harness checks.

Process tools

• exec_command starts an interactive command session and returns either output or a session id.
• write_stdin sends input to an existing command session and polls recent output.
• unified_exec exposes the Codex-shaped single-tool session contract over the same persistent process pool.
• shell runs a single shell command and returns aggregated output.

Process tools honor the configured command shell and the current turn deadline. In eval-profile runs, long process timeouts are capped before the finalization reserve so the model can still write a final answer or scoreable output.

Tool allowlists

Distributions can narrow the advertised tool set with [tools].allowlist. The runtime filters tool specs before they are sent to the model, which is useful for headless task-specific builds that should not expose generic editing or shell tools.

[tools]
allowlist = ["zerolang_skills_get", "zerolang_check", "zerolang_edit"]

Extension tools

• web_search from the web-search router extension.
• task from the subagent extension, with optional per-agent namespaced tools.
• agent_swarm for bounded fanout of one prompt template across many items.
• knowledge_* tools for markdown-backed project knowledge documents.
• media_generate_image, media_attach, and related media artifact tools.
• zerolang_* graph-inspection and checked-edit tools from the Zerolang extension.
• MCP tools loaded by roder-ext-mcp from configured streamable HTTP servers.
• Provider or product-specific tools installed by custom extensions.

Workspace and fork controls

Clients can branch agent work without teaching models about provider internals.Workspace forks expose thread and workspace fork methods, while tool execution still runs through the active policy mode and scoped workspace handles.

Policy modes

• default - writes, process, and network are allowed subject to approval policy.
• accept_edits - edit tools are auto-approved while other risky operations still pass through policy.
• plan - blocks writes and process execution, requires user approval to exit.
• bypass - auto-approves all tools and emits a bypass warning event.

cargo run -p roder-cli -- --mode plan
cargo run -p roder-cli -- --mode accept-edits
cargo run -p roder-cli -- --yolo